1054753 - Assertion failure: !ptr->isEffectful(), at jit/IonBuilder.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

g = (function() {
    var Int32ArrayView = Int32Array();
    function f() {
        Int32ArrayView[Symbol() >> 2]
    }
    return f;
})();
try {
    g();
} catch (e) {}
g();

asserts js debug shell on m-c changeset 94ba78a42305 with --no-threads --ion-offthread-compile=off --ion-eager at Assertion failure: !ptr->isEffectful(), at jit/IonBuilder.cpp

My configure flags are:

LD=ld CROSS_COMPILE=1 CC="clang -Qunused-arguments -msse2 -mfpmath=sse -arch i386" RANLIB=ranlib CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse -arch i386" AS=$CC AR=ar STRIP="strip -x -S" HOST_CC="clang -Qunused-arguments -msse2 -mfpmath=sse" HOST_CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse" sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=i386-apple-darwin9.2.0 --enable-macos-target=10.5 --enable-debug --enable-optimize --enable-gczeal --enable-debug-symbols --disable-tests --enable-more-deterministic --with-ccache --enable-nspr-build

Guessing this to be related to the JIT stuff from Symbol, so setting needinfo? from Hannes. Please feel free to pass this forward if this is not the case.

Comment 1

[Christian Holler (:decoder)]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 2

[Hannes Verschore [:h4writer]]

Attachment: All infer functions should not optimize when encountering MIRType_Symbol

All infer functions should not optimize when encountering MIRType_Symbol.

Comment 3

[Nicolas B. Pierron [:nbp]]

Comment on attachment 8474559 [details] [diff] [review]
All infer functions should not optimize when encountering MIRType_Symbol

Review of attachment 8474559 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jit/MIR.cpp
@@ +1296,5 @@
>  
>  void
>  MBitNot::infer()
>  {
> +    if (getOperand(0)->mightBeType(MIRType_Object) || getOperand(0)->mightBeType(MIRType_Symbol))

This seems to be a common pattern, maybe we should add a mightBeType2()

Comment 4

[Hannes Verschore [:h4writer]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/9ef873917571

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/8e4e04daf2a6
user:        [e-mail], Jason Orendorff
date:        Thu Jul 31 09:05:18 2014 -0500
summary:     Bug 1042602 - Symbol behavior changes in ES6 draft rev 26. r=h4writer.

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/9ef873917571